File name:

UnivMenu_1.16.7z

Full analysis: https://app.any.run/tasks/4c6a3e26-30ff-444a-9d2a-76e746e63694
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 13, 2024, 20:57:35
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
lumma
stealer
exfiltration
pastebin
silentcryptominer
miner
opendir
crypto-regex
upx
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

5A643CA6DB7C42CE8EF4F7FD7C9B1F98

SHA1:

DC0806360A0C41F0A8171633CA5BE6FA8B0BCA29

SHA256:

B00DB80C33FFFE8E0484331C39CB8A34210A6AE5B5C553920EF038B7DE087B20

SSDEEP:

98304:D00h6ACai0icMqaj54c3vKkg4n0S99z+kvhqG2x4cP2p+jSKqKP2Oe8y6BasGdPf:hdNrDZoTBJD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Loader.exe (PID: 1476)
      • wmiss.exe (PID: 4252)
      • wmi.exe (PID: 504)
      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Uses Task Scheduler to run other applications

      • wmi.exe (PID: 504)

    • Adds extension to the Windows Defender exclusion list

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Creates a writable file in the system directory

      • powershell.exe (PID: 5236)

    • SILENTCRYPTOMINER has been detected (SURICATA)

      • dwm.exe (PID: 2532)

    • Connects to the CnC server

      • dwm.exe (PID: 2532)

    • LUMMA has been detected (SURICATA)

      • aspnet_regiis.exe (PID: 1916)

    • Actions looks like stealing of personal data

      • aspnet_regiis.exe (PID: 1916)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Loader.exe (PID: 1476)
      • wmiss.exe (PID: 4252)
      • wmi.exe (PID: 504)
      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Reads the Internet Settings

      • aspnet_regiis.exe (PID: 1916)

    • Reads settings of System Certificates

      • aspnet_regiis.exe (PID: 1916)

    • Script adds exclusion extension to Windows Defender

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Starts POWERSHELL.EXE for commands execution

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Starts CMD.EXE for commands execution

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Starts SC.EXE for service management

      • wmis.exe (PID: 3132)

    • Searches for installed software

      • aspnet_regiis.exe (PID: 1916)

    • Uses powercfg.exe to modify the power settings

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • Process uninstalls Windows update

      • wusa.exe (PID: 1956)
      • wusa.exe (PID: 4368)

    • Script adds exclusion path to Windows Defender

      • wmis.exe (PID: 3132)
      • update.exe (PID: 2956)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 5236)

    • Drops a system driver (possible attempt to evade defenses)

      • update.exe (PID: 2956)

    • Contacting a server suspected of hosting an CnC

      • aspnet_regiis.exe (PID: 1916)

    • Executes as Windows Service

      • update.exe (PID: 2956)

    • Connects to unusual port

      • dwm.exe (PID: 2532)

    • Found regular expressions for crypto-addresses (YARA)

      • wmi.exe (PID: 504)

    • Crypto Currency Mining Activity Detected

      • dwm.exe (PID: 2532)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2796)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2796)

    • Checks supported languages

      • Loader.exe (PID: 1476)
      • wmis.exe (PID: 3132)
      • wmi.exe (PID: 504)
      • aspnet_regiis.exe (PID: 1916)
      • wmiss.exe (PID: 4252)
      • update.exe (PID: 2956)

    • Creates files or folders in the user directory

      • wmi.exe (PID: 504)
      • wmiss.exe (PID: 4252)

    • Reads the computer name

      • aspnet_regiis.exe (PID: 1916)
      • wmiss.exe (PID: 4252)

    • Reads the software policy settings

      • aspnet_regiis.exe (PID: 1916)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5788)
      • powershell.exe (PID: 5236)

    • Reads the machine GUID from the registry

      • aspnet_regiis.exe (PID: 1916)

    • Creates files in the program directory

      • wmis.exe (PID: 3132)

    • UPX packer has been detected

      • dwm.exe (PID: 2532)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2796)

    • Create files in a temporary directory

      • Loader.exe (PID: 1476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
50
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe loader.exe no specs loader.exe wmis.exe wmiss.exe conhost.exe no specs THREAT wmi.exe schtasks.exe no specs #LUMMA aspnet_regiis.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs update.exe choice.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #SILENTCRYPTOMINER dwm.exe wusa.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504C:\Users\admin\AppData\Local\Temp\wmi.exeC:\Users\admin\AppData\Local\Temp\wmi.exe
Loader.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\wmi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
580\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
988\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1136\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1476"C:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Loader.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Loader.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2796.8718\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1736"C:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Loader.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Loader.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2796.8718\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1740\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1788C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartC:\Windows\System32\cmd.exe—update.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
87
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1820C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0C:\Windows\System32\powercfg.exe—wmis.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
1856\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
Total events
27 554
Read events
27 527
Write events
27
Delete events
0

Modification events

(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:VerInfo
Value:
005B0500F0886D5067D5DA01
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\UnivMenu_1.16.7z
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
8
Suspicious files
3
Text files
58
Unknown types
0

Dropped files

PID
Process
Filename
Type
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (10) - Copy.txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (11) - Copy.txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (16).txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (11).txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (12) - Copy.txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (13).txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (12).txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (14) - Copy.txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (15).txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2796.8718\Data\gsdagsdg - Copy (17) - Copy.txttext
MD5:A855A4B3C1CEA75E19FEA7F6A2E0281B
SHA256:6FA90940945D0FEFA4E6433238D41C208244CF7449E9646F36A542DA78D394E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
30
DNS requests
10
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.35.236.109:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
—
1332
svchost.exe
GET
200
88.221.110.147:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
3984
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4853f0d6c45594a7
unknown
—
—
whitelisted
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1088
svchost.exe
POST
403
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4552
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1332
svchost.exe
88.221.110.216:80
—
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1504
svchost.exe
23.43.61.160:443
fs.microsoft.com
Akamai International B.V.
US
unknown
1332
svchost.exe
88.221.110.147:80
—
Akamai International B.V.
DE
unknown
3984
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3984
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2844
svchost.exe
20.189.173.26:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2844
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1088
svchost.exe
184.28.89.167:80
go.microsoft.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
fs.microsoft.com
  • 23.43.61.160
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.68
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
v10.events.data.microsoft.com
  • 20.189.173.26
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
bitchsafettyudjwu.shop
  • 172.67.168.236
  • 104.21.27.50
malicious
xmr-eu1.nanopool.org
  • 51.15.193.130
  • 51.89.23.91
  • 146.59.154.106
  • 51.15.65.182
  • 54.37.232.103
  • 212.47.253.124
  • 141.94.23.83
  • 163.172.154.142
  • 51.15.58.224
  • 54.37.137.114
  • 162.19.224.121
whitelisted
pastebin.com
  • 172.67.19.24
  • 104.20.4.235
  • 104.20.3.235
shared

Threats

PID
Process
Class
Message
1332
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
1656
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup
1916
aspnet_regiis.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity M2
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
1916
aspnet_regiis.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain
—
—
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
1916
aspnet_regiis.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UnivMenu_1.16.7z